GDPR Readiness Check
How data-protection-fit are you?
20 questions, 5 categories, 3 minutes. See where your company already lives the GDPR and where gaps are still lurking.
Data protection is more than a privacy policy
The GDPR has applied since May 2018 — and yet, when it matters, companies rarely come unstuck over their website. They come unstuck over evidence. The regulation demands accountability (Art. 5(2)): you have to be able to show that you work in a compliant way. Not claim it — show it. The check above looks at exactly that ability to demonstrate.
The duties that really count
| Duty | Article | What is often missing |
|---|---|---|
| Record of processing activities | Art. 30 | it exists, but it is years old and does not cover newer tools |
| Technical and organisational measures | Art. 32 | written in general terms instead of concretely and verifiably |
| Processing on behalf (DPA) | Art. 28 | missing for cloud services that were adopted “on the side” |
| Data subject rights | Art. 15–22 | no defined process — but the one-month clock runs anyway |
| Breach notification | Art. 33 | no reporting chain; 72 hours pass quickly |
| Data protection impact assessment | Art. 35 | simply not done for risky processing |
The classic that gets underestimated: the deletion plan. The GDPR requires storage limitation — data may be kept only as long as the purpose requires. In practice almost nobody deletes systematically. Authorities like to ask about exactly this, because it is easy to check.
Do you need a data protection officer?
Under Art. 37 GDPR and § 38 BDSG, put simply: you need an officer if
- as a rule at least twenty people are routinely engaged in the automated processing of personal data, or
- you carry out processing that requires a data protection impact assessment , or
- you process data commercially for the purpose of transfer, or process special categories (health, biometrics, …) on a large scale.
“Twenty people” does not mean twenty IT staff — everyone who regularly handles personal data at a computer counts. Small companies reach that number faster than they expect.
How to read your result
- Considerable action needed — basics such as the processing record or processor agreements are missing. In an inspection that is immediately relevant to a fine, because it is objectively verifiable.
- Solid basis with gaps — the documents exist but are not current, or processes for data subject rights and breaches are missing.
- Well positioned — the evidence is there and kept up. What is left is usually the deletion plan, training and regular review.
The check is a self-assessment and is no substitute for legal advice.
The pragmatic route
Data protection and information security overlap heavily: the measures required by Art. 32 are in effect what an ISMS already governs — access control, encryption, availability, resilience, regular review. Maintaining both separately in spreadsheets means doing the work twice. One shared system makes more sense: one register of assets and providers, feeding the processing record, the overview of processor agreements and the evidence for your security measures.
Common questions about the GDPR
From what point do we need a data protection officer?
As a rule from twenty people routinely processing personal data by automated means. Regardless of that number, also where you carry out processing that requires an impact assessment, process special categories on a large scale, or process data commercially for the purpose of transfer.
How large can the fines be?
Up to €20 million or 4 % of worldwide annual turnover, whichever is higher. For certain infringements the ceiling is €10 million or 2 %. In practice the most common causes are missing legal bases, inadequate security measures and breaches of data subject rights.
What has to happen after a data breach?
Notification to the supervisory authority within 72 hours of becoming aware, where there is a risk to the people affected. Where the risk is high, they have to be informed as well. What decides it is whether your staff know whom to tell immediately — otherwise the deadline passes before anyone reacts.
Do we need a processing agreement for every tool?
Whenever a provider processes personal data on your behalf — which covers most cloud services, from newsletter tools to HR software. Without an agreement the processing is formally unlawful.
Is a template processing record from the internet enough?
As a starting point yes, as evidence no. The record has to reflect your actual processing — purposes, legal bases, recipients, retention periods. A generic template stands out immediately in an inspection.
How do the GDPR and ISO 27001 relate?
ISO 27001 is not proof of data protection compliance, but it provides the structure for the measures required by Art. 32 and for accountability. Many companies use the ISMS as a shared foundation and add the privacy-specific documents on top.
